Configure and verify single area OSPFv2

OSPF (Open Shortest Path First) is the dynamic routing protocol the CCNA focuses on. It is an open standard (RFC 2328 for OSPFv2, the IPv4 version), runs on equipment from every vendor, scales to very large networks, and converges quickly after a failure. The exam requires you to understand how it works, configure it in a single area, and read its verification output. This is the longest section in the chapter; take it slowly.

Why dynamic routing at all?

Static routes break down as networks grow. With 50 routers and 200 subnets you would have to type thousands of ip route commands, and every time a link failed someone would have to log in and change them. A dynamic routing protocol lets routers tell each other about the networks they know, calculate the best paths automatically, and react to failures in seconds without human help.

Dynamic routing protocols come in two families:

• Distance-vector protocols (RIP, and in a hybrid way EIGRP) learn routes by rumor: each router tells its neighbors “I can reach network X at distance Y” and the neighbors trust it without knowing the full map.
• Link-state protocols (OSPF, IS-IS) work like a shared map: every router describes its own links to everyone, all routers assemble an identical map of the whole area, and each router independently computes the shortest path to every destination from its own position on the map.

The link-state concept: LSAs, the LSDB, and SPF

OSPF works in three stages.

Stage 1: Describe your links with LSAs. Every OSPF router creates Link-State Advertisements (LSAs), small data records describing its own interfaces (subnet, cost, and which neighbors are attached). The most important types for the CCNA are:

In a single-area network you mostly see Type 1 and Type 2 LSAs, plus a Type 5 if someone injects a default route with default-information originate.

Stage 2: Flood the LSAs to build an identical LSDB. Each router sends its LSAs to its neighbors, who store them and pass them on, until every router in the area holds every LSA. The collection of all LSAs is the Link-State Database (LSDB). Within one area, every router’s LSDB is identical; that is a rule, not a coincidence, and OSPF has mechanisms (sequence numbers, acknowledgments, periodic refresh every 30 minutes) to keep it that way. show ip ospf database displays the LSDB.

Stage 3: Run SPF to compute routes. Each router runs Dijkstra’s Shortest Path First (SPF) algorithm on the LSDB, placing itself at the root of a tree and computing the lowest-cost path to every subnet. The results go into the routing table as O routes with AD 110 and metric equal to the path cost. When any LSA changes (a link goes down, a cost changes), the change is flooded and every router reruns SPF.

The three stages map to three data structures you can inspect:

OSPF packets and how neighbors find each other

OSPF does not use TCP or UDP; it rides directly inside IP as protocol number 89. It sends five packet types:

Hellos are sent to the multicast address 224.0.0.5 (all OSPF routers). On multi-access networks some traffic is sent to 224.0.0.6 (all DR/BDR routers) instead; more on that under 3.4.c. Because these are link-local multicasts, they never cross a router, so OSPF neighbors must be directly connected on the same link.

Areas and the backbone

OSPF divides a network into areas, numbered from 0 to 4,294,967,295 (a 32-bit value, which can also be written in dotted form like 0.0.0.0). All routers in an area share one LSDB and run SPF over it. Splitting a large network into areas keeps each LSDB small and confines the SPF recalculation to the area where a change occurred.

• Area 0 is the backbone area. Every other area must connect directly to area 0.
• A router with all interfaces in one area is an internal router.
• A router with interfaces in two or more areas is an Area Border Router (ABR); it sits between area 0 and a non-backbone area and creates Type 3 summary LSAs.
• A router that injects routes from outside OSPF (static routes, another protocol) is an Autonomous System Boundary Router (ASBR).
• A backbone router has at least one interface in area 0.

The CCNA requires only single-area OSPF, meaning every interface on every router is in area 0. You still need the vocabulary above because exam questions and show output reference it, and because you will see O IA routes if the network has more than one area.

Basic OSPF configuration

There are two ways to enable OSPF on an interface. Both are on the exam.

Method 1: the network command in router configuration mode. This is the traditional method. You start the OSPF process with router ospf <process-id> and then use network statements to tell the process which interfaces to enable, based on their IP addresses.

R1(config)# router ospf 1
! Start OSPF process 1. The process ID is locally significant only.
R1(config-router)# router-id 1.1.1.1
! Manually set the router ID (strongly recommended)
R1(config-router)# network 10.1.1.0 0.0.0.255 area 0
! Enable OSPF on any interface whose IP is inside 10.1.1.0/24, in area 0
R1(config-router)# network 10.1.12.0 0.0.0.255 area 0
R1(config-router)# network 10.1.15.0 0.0.0.3 area 0
! Wildcard 0.0.0.3 matches a /30
R1(config-router)# passive-interface GigabitEthernet0/0
! LAN interface: advertise its subnet but do not send hellos on it

The network command uses a wildcard mask, not a subnet mask. A wildcard mask is the inverse of a subnet mask: 0 bits mean “must match”, 1 bits mean “don’t care.” So 0.0.0.255 means “match the first 24 bits”, the inverse of 255.255.255.0. To convert a subnet mask to a wildcard, subtract each octet from 255: 255.255.255.252 becomes 0.0.0.3.

The network command does not advertise a network directly. It finds every interface whose IP address falls inside the range and enables OSPF on that interface; OSPF then advertises the interface’s actual subnet and mask, whatever it is. That is why network 0.0.0.0 255.255.255.255 area 0 (match everything) enables OSPF on every interface at once, and why network 10.1.12.1 0.0.0.0 area 0 (match exactly one address) enables it on just the interface with that IP.

Method 2: the interface command. Newer IOS versions let you enable OSPF directly on each interface, which many engineers find clearer:

R2(config)# router ospf 1
R2(config-router)# router-id 2.2.2.2
R2(config-router)# exit
R2(config)# interface GigabitEthernet0/1
R2(config-if)# ip ospf 1 area 0
! Enable OSPF process 1, area 0, on this interface
R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip ospf 1 area 0

Both methods produce identical results, and you can mix them on one router. show ip ospf interface reports which one was used (“Attached via Network Statement” or “Attached via Interface Enable”).

3.4.d Router ID

Every OSPF router identifies itself with a Router ID (RID): a 32-bit number written like an IPv4 address, such as 1.1.1.1. The RID appears in every LSA the router generates, in show ip ospf neighbor on other routers, and in the DR/BDR election. It does not have to be a reachable address; it is just a name. When the OSPF process starts, it chooses the RID in this strict order:

1. The value set manually with the router-id <a.b.c.d> command under router ospf.
2. If none, the highest IP address on any loopback interface that is up.
3. If no loopbacks, the highest IP address on any active (up/up) physical interface.

“Highest” is a plain numeric comparison: 10.255.0.1 beats 10.1.99.1, and 192.168.1.1 beats both. Note that the choice is made once, when the process starts. If you later add a loopback with a higher address, or configure router-id, the running process keeps its old RID until it restarts. To apply a new RID you must either reload the router or clear the process:

R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
% OSPF: Reload or use "clear ip ospf process" command, for this to take effect
R1(config-router)# end
R1# clear ip ospf process
Reset ALL OSPF processes? [no]: yes

Clearing the process drops every adjacency and reforms them, which is disruptive on a production network; that is why you should set the RID manually before enabling any interfaces.

Router IDs must be unique within the OSPF domain. If two routers have the same RID, they will not form an adjacency with each other, and worse, LSAs from the two routers will overwrite each other on other routers, corrupting the LSDB. IOS logs a %OSPF-4-DUP_RTRID_NBR message when it sees a duplicate.

Verify the RID with:

R1# show ip ospf
 Routing Process "ospf 1" with ID 1.1.1.1
 Start time: 00:02:14.360, Time elapsed: 01:12:55.108
 ...
R1# show ip protocols | include Router ID
  Router ID 1.1.1.1

3.4.a Neighbor adjacencies

Two OSPF routers on the same link become neighbors by exchanging Hello packets and then, in most cases, become fully adjacent by synchronizing their LSDBs. The exam tests the states a neighbor relationship passes through and the conditions that must be met for it to form at all.

Requirements for forming an adjacency

Each Hello packet carries a set of parameters. If any of the following do not match between two routers on a link, they will not become neighbors (they stay in Down or Init, or never appear in show ip ospf neighbor):

The process ID and the interface cost are not in this list; they can differ freely.

The dead interval is how long a router waits without hearing a Hello before declaring the neighbor dead. By default it is four times the hello interval. Changing the hello interval with ip ospf hello-interval <seconds> automatically resets the dead interval to four times the new value; you can also set it explicitly with ip ospf dead-interval <seconds>.

Neighbor states

A neighbor relationship moves through these states, in order. You see the current state in the State column of show ip ospf neighbor.

The important distinction is between 2-Way and Full:

• Full means the two routers have exchanged their complete LSDBs and will keep them synchronized. Routes are exchanged only over Full adjacencies.
• 2-Way is a healthy, stable state between two DROther routers on a broadcast network. DROthers do not exchange LSDBs with each other; they exchange them only with the DR and BDR. So on a segment with four routers, a DROther will show FULL with the DR and BDR and 2WAY with the other DROther. That is normal and correct, not a problem.

On a point-to-point link there is no DR/BDR, so both routers go all the way to Full with each other, and the state column shows FULL/ -.

Sample output from R1, which has four routers on its Gi0/1 segment (R1 is a DROther) and one point-to-point serial neighbor:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           1   FULL/DR         00:00:35    10.1.12.2       Gi0/1
3.3.3.3           1   FULL/BDR        00:00:38    10.1.12.3       Gi0/1
4.4.4.4           1   2WAY/DROTHER    00:00:33    10.1.12.4       Gi0/1
5.5.5.5           0   FULL/  -        00:00:36    10.1.15.2       Se0/0/0

How to read each column:

• Neighbor ID: the neighbor’s router ID (not its interface address).
• Pri: the neighbor’s interface priority for the DR election (default 1).
• State: the neighbor state, a slash, and the neighbor’s role on this segment (DR, BDR, DROTHER, or - on point-to-point links).
• Dead Time: countdown; it resets to 40 each time a Hello arrives. If it reaches 0 the neighbor is declared down.
• Address: the neighbor’s actual interface IP address on this link.
• Interface: the local interface through which the neighbor is reached (IOS prints the full name; it is abbreviated here to fit the page).

3.4.b Point-to-point

OSPF adapts its behavior to the type of link it is running on. The network type is a per-interface setting, chosen automatically from the interface’s Layer 2 encapsulation and changeable with ip ospf network <type>. The two types the CCNA cares about are point-to-point and broadcast.

A point-to-point network type is used on links with exactly two devices, such as a serial line running HDLC or PPP. IOS chooses this type automatically on serial interfaces. Its characteristics:

• No DR/BDR election. With only two routers there is nothing to optimize; the two routers simply become Full with each other. show ip ospf neighbor shows FULL/ -.
• Hellos go to 224.0.0.5, hello 10 seconds, dead 40 seconds (same as broadcast).
• Adjacency forms slightly faster because there is no election wait timer.
• Only Type 1 LSAs describe the link; no Type 2 Network LSA is generated.

You can, and often should, set the point-to-point type manually on an Ethernet link that connects only two routers (for example, a Gigabit link between two core routers). Ethernet defaults to broadcast, which would trigger a pointless DR/BDR election and generate an unnecessary Type 2 LSA. The command is:

R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip ospf network point-to-point

Both ends must be set the same way. Verify with show ip ospf interface:

R1# show ip ospf interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  Internet Address 10.1.12.1/30, Area 0, Attached via Network Statement
  Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_POINT, Cost: 1
  Topology-MTID    Cost    Disabled    Shutdown      Topology Name
        0           1         no          no            Base
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:07
  ...
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2

Note that “State POINT_TO_POINT” replaces the DR/BDR/DROTHER role that a broadcast interface would show.

3.4.c Broadcast (DR/BDR selection)

The broadcast network type is the default on all Ethernet interfaces. It assumes a multi-access segment where many routers might share one LAN or VLAN. Its defining feature is the election of a Designated Router (DR) and a Backup Designated Router (BDR).

Why a DR is needed

If N routers on a LAN all formed full adjacencies with each other, there would be N x (N - 1) / 2 adjacencies: 10 routers means 45 adjacencies, each one flooding LSAs to every other. That wastes bandwidth and CPU. Instead, OSPF elects one router, the DR, to act as the central point:

• Every router forms a Full adjacency with the DR and with the BDR only.
• Routers that are neither DR nor BDR are called DROthers, and they stay in the 2-Way state with each other.
• When a DROther has a topology change, it sends the LSU to 224.0.0.6 (the AllDR address), which only the DR and BDR listen to. The DR then floods it to everyone on the segment via 224.0.0.5.
• The DR also generates the Type 2 Network LSA that describes the segment and lists the routers attached to it.

The BDR listens to everything the DR does and takes over instantly if the DR fails, after which a new BDR is elected.

The election

When the first router on a segment finishes the wait timer (equal to the dead interval, 40 seconds by default), an election happens among all routers that have reached 2-Way:

1. The router with the highest OSPF interface priority becomes the DR. The second highest becomes the BDR.
2. If priorities tie (they usually do, since the default is 1), the router with the highest Router ID becomes the DR, and the second highest becomes the BDR.
3. A priority of 0 means the router never participates: it can never be DR or BDR, only DROther.

Priority is set per interface, in the range 0 to 255, with ip ospf priority <number>. It is a per-interface value, so a router can be DR on one segment and DROther on another.

R2(config)# interface GigabitEthernet0/1
R2(config-if)# ip ospf priority 200
! Make R2 the preferred DR on this segment (after the next election)
R4(config)# interface GigabitEthernet0/1
R4(config-if)# ip ospf priority 0
! R4 will never become DR or BDR here

The election is non-preemptive. Once a DR is elected it stays DR until it goes down or its OSPF process is cleared, even if a router with a higher priority or RID joins the segment later. The newcomer simply becomes a DROther (or BDR if the BDR slot is open). In practice, this means the DR on a live network is often whichever router booted first, which is why the exam says “the DR is the router with the highest priority, then highest RID, at the time of the election.” To force a re-election on a segment you can shut and unshut interfaces or run clear ip ospf process on the current DR.

Verify the election with show ip ospf neighbor (the role column) and with show ip ospf interface:

R1# show ip ospf interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  Internet Address 10.1.12.1/24, Area 0, Attached via Network Statement
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 1
  Topology-MTID    Cost    Disabled    Shutdown      Topology Name
        0           1         no          no            Base
  Transmit Delay is 1 sec, State DROTHER, Priority 1
  Designated Router (ID) 2.2.2.2, Interface address 10.1.12.2
  Backup Designated router (ID) 3.3.3.3, Interface address 10.1.12.3
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    oob-resync timeout 40
    Hello due in 00:00:04
  Supports Link-local Signaling (LLS)
  Cisco NSF helper support enabled
  IETF NSF helper support enabled
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 1
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 3, Adjacent neighbor count is 2
    Adjacent with neighbor 2.2.2.2  (Designated Router)
    Adjacent with neighbor 3.3.3.3  (Backup Designated Router)
  Suppress hello for 0 neighbor(s)

“Neighbor Count is 3, Adjacent neighbor count is 2” is the tell-tale signature of a DROther: it has three neighbors on the segment but is fully adjacent only with the DR and BDR. A briefer summary is available with show ip ospf interface brief:

R1# show ip ospf interface brief
Interface    PID   Area            IP Address/Mask    Cost  State Nbrs F/C
Gi0/1        1     0               10.1.12.1/24       1     DROTH 2/3
Gi0/0        1     0               10.1.1.1/24        1     DR    0/0
Se0/0/0      1     0               10.1.15.1/30       64    P2P   1/1

Nbrs F/C means “Full / Count.” Gi0/0 shows DR 0/0 because R1 is the only OSPF router on its LAN (and the interface is passive, so no neighbors can form anyway). Se0/0/0 has cost 64, which is the OSPF cost of a 1.544 Mbps T1 serial link; see the cost section.

OSPF cost and reference bandwidth

OSPF’s metric is cost. Each interface has a cost, and a route’s metric is the sum of the costs of the outgoing interfaces along the path from the router to the destination, including the last router’s interface onto the destination subnet (the incoming side of each link is not counted). Lower total cost wins. The default cost of an interface is:

cost = reference bandwidth / interface bandwidth

The default reference bandwidth is 100 Mbps (10^8 bps), and the result is rounded down to an integer with a minimum of 1. This was fine in the 1990s but creates a real problem today:

With the default, FastEthernet, GigabitEthernet, and 10 Gigabit all cost 1, so OSPF cannot tell them apart and might load-balance a Gigabit path with a FastEthernet path. The fix is to raise the reference bandwidth on every router in the OSPF domain (it must be consistent, or different routers will disagree about path costs):

R1(config)# router ospf 1
R1(config-router)# auto-cost reference-bandwidth 10000
! Value is in Mbps. 10000 = 10 Gbps. IOS warns you to set it on all routers.

The “interface bandwidth” in the formula is the interface’s configured bandwidth value (show interfaces shows BW 1000000 Kbit/sec), not its actual speed. On serial links the default bandwidth is 1544 Kbps regardless of the real clock rate, which is why you may set bandwidth <kbps> on serial interfaces. Alternatively, you can bypass the formula entirely and set a cost directly:

R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip ospf cost 5
! Directly set this interface's cost (1 to 65535); overrides the formula

ip ospf cost is the most precise way to influence path selection and is what you should use when a question asks “how to make OSPF prefer path A over path B.”

Passive interfaces

A passive interface is one on which OSPF advertises the subnet but does not send or receive Hellos, so no neighbor can form on it. Use it on interfaces that face end users or servers (there is no router there to talk to) for three reasons: it stops wasting bandwidth on Hellos, it prevents a rogue device on the LAN from forming an adjacency and injecting bad routes, and it is simply cleaner.

R1(config)# router ospf 1
R1(config-router)# passive-interface GigabitEthernet0/0

If most interfaces should be passive, flip the default and un-passive only the router-to-router links:

R1(config-router)# passive-interface default
R1(config-router)# no passive-interface GigabitEthernet0/1
R1(config-router)# no passive-interface Serial0/0/0

show ip protocols lists the passive interfaces. A common design is a loopback interface (which is always up and hosts the RID) advertised as passive.

Advertising a default route with default-information originate

A router that has a default route (typically the edge router with a static default toward the ISP) can advertise it into OSPF so that every other router learns a default route dynamically instead of needing its own static:

R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
R1(config)# router ospf 1
R1(config-router)# default-information originate

R1 becomes an ASBR and floods a Type 5 LSA for 0.0.0.0/0. On every other router in the area, the route appears as:

R2# show ip route | include 0.0.0.0
Gateway of last resort is 10.1.12.1 to network 0.0.0.0
O*E2  0.0.0.0/0 [110/1] via 10.1.12.1, 00:04:10, GigabitEthernet0/1

The code O*E2 means OSPF, candidate default, external type 2. By default the advertisement is generated only while R1 itself actually has a default route in its routing table; adding the keyword always (default-information originate always) advertises it unconditionally.

Verification commands summary

You have seen most of these already; this table collects them in one place.

Two of these deserve sample output. First, the LSDB:

R1# show ip ospf database

            OSPF Router with ID (1.1.1.1) (Process ID 1)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
1.1.1.1         1.1.1.1         245         0x80000004 0x00A1B2 3
2.2.2.2         2.2.2.2         251         0x80000003 0x00C3D4 2
3.3.3.3         3.3.3.3         248         0x80000003 0x00E5F6 2
4.4.4.4         4.4.4.4         250         0x80000002 0x001122 2
5.5.5.5         5.5.5.5         240         0x80000003 0x003344 3

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
10.1.12.2       2.2.2.2         251         0x80000001 0x001234

Every router in area 0 has one Router LSA (Type 1), listed by RID. There is one Net LSA (Type 2) for the broadcast segment, advertised by the DR (2.2.2.2) and identified by the DR’s interface address (10.1.12.2). Every router in the area shows this identical database. If a router is missing from the list, it is not participating in the area.

Second, show ip protocols, which is the best single-screen sanity check:

R1# show ip protocols
*** IP Routing is NSF aware ***

Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 1.1.1.1
  Number of areas in this router is 1. 1 normal 0 stub 0 nssa
  Maximum path: 4
  Routing for Networks:
    10.1.1.0 0.0.0.255 area 0
    10.1.12.0 0.0.0.255 area 0
    10.1.15.0 0.0.0.3 area 0
  Passive Interface(s):
    GigabitEthernet0/0
  Routing Information Sources:
    Gateway         Distance      Last Update
    2.2.2.2              110      00:05:12
    3.3.3.3              110      00:05:12
    5.5.5.5              110      00:05:40
  Distance: (default is 110)

Maximum path: 4 is the default number of equal-cost paths OSPF installs. Routing Information Sources lists the RIDs from which routes have been received.

Common OSPF troubleshooting scenarios

When OSPF is not working, check in this order:

1. Is the interface up/up and does it have the right IP? show ip interface brief. No interface, no OSPF.
2. Is OSPF enabled on the interface? show ip ospf interface brief. If the interface is missing, the network statement does not cover its IP (check the wildcard mask) or the ip ospf <pid> area command is absent.
3. Is the interface passive? show ip protocols. A passive interface will never form a neighbor.
4. Do the Hello parameters match? Compare show ip ospf interface on both routers: area, hello/dead timers, network type, subnet mask, authentication. A neighbor that never appears in show ip ospf neighbor usually means one of these mismatches. debug ip ospf hello or debug ip ospf adj shows the specific mismatch message on a lab router.
5. Are the RIDs unique? Look for %OSPF-4-DUP_RTRID_NBR in the log.
6. Is the neighbor stuck in ExStart/Exchange? Check show interfaces for the MTU on both sides; make them match, or use ip ospf mtu-ignore on the interface.
7. Neighbor is Full but the route is missing? Check whether another source with a lower AD (a static route, EIGRP) is winning for the same prefix (show ip route <address> reveals the source), or whether the remote interface is not in OSPF at all.
8. Route is present but the path is wrong? Check costs: with the default reference bandwidth, all fast links cost 1. Use auto-cost reference-bandwidth or ip ospf cost.
9. An ACL is blocking OSPF? OSPF is IP protocol 89; an inbound ACL on the interface that does not permit ospf (or ip any any) blocks Hellos.